From 76d092d4f62dc486dee8d25a347513e2fdafab4d Mon Sep 17 00:00:00 2001 From: adlee-was-taken Date: Sat, 2 May 2026 16:26:09 -0400 Subject: [PATCH] docs(architecture): note settings.enc + typed items in vault-creation flow (audit F10) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Vault Creation Flow ASCII showed only manifest.enc as init's encrypted artifact; cmd_init has been writing settings.enc in parallel since the VaultSettings rollout. Update the encrypt step to show both artifacts side-by-side with independent nonces. Below the ASCII, add a short pointer noting that the per-item lifecycle (typed-item envelope, attachment encryption, field-history) lives in crates/relicario-core/ARCHITECTURE.md and reuses the same master_key + XChaCha20-Poly1305 primitives. The doc-audit framing is "this top-level doc could just point at the per-crate docs" — taking that trim path. Co-Authored-By: Claude Opus 4.7 --- docs/ARCHITECTURE.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 02bb07f..f5d67a7 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -83,8 +83,9 @@ vault_salt ────────►│ │ ┌──────────────────┐ master_key ────────►│ XChaCha20- │──────► manifest.enc -empty manifest ────►│ Poly1305 │ - └──────────────────┘ +empty manifest ────►│ Poly1305 │ settings.enc +default settings ──►│ encrypt (×2) │ (parallel artifacts; + └──────────────────┘ independent nonces) ┌──────────────────┐ │ git init │──────► vault repo @@ -92,6 +93,14 @@ empty manifest ────►│ Poly1305 │ └──────────────────┘ ``` +Item creation, the typed-item envelope (`Item` + per-type `ItemCore`), +attachment encryption, and field-history tracking are not shown above — +they are described in [`crates/relicario-core/ARCHITECTURE.md`](../crates/relicario-core/ARCHITECTURE.md). +The flow above covers only the crypto-pipeline shape that vault init +establishes; the per-item lifecycle reuses the same `master_key` + +XChaCha20-Poly1305 primitives against `items/.enc` and +`attachments//.enc`. + ## Unlock Flow (every vault operation) ```